MasjidNexus is provided by Moosa Salim, an individual developer in Oman, trading as SmartHorizon (“we”, “us”). This policy explains what personal data we handle when you use the MasjidNexus website, the admin portal (on the web and in the iPhone and Android apps), the TV app and the congregation app, and the choices you have.
For questions or requests about your data, email support@masjidnexus.com.
In short
- The congregation app needs no account, and none of our apps or the website use analytics, advertising or tracking.
- Masjid admins give us an email address and their masjid’s details so that we can run the service.
- We don’t sell personal data, and we don’t use it for advertising.
Who this covers
- Masjid admins: people who manage a masjid in the admin portal.
- Worshippers: people who use the congregation app.
- Website visitors, including anyone who uses the contact form.
TV screens are devices, not people; what they send is described below.
What we collect
Masjid admins
- Your account: your email address, your password (kept by our sign-in provider in a protected, hashed form that we can’t read), an optional display name, your preferred language, and whether you’ve set up an authenticator app. If you sign in with Google or Apple, they give us your name and email address.
- Your masjid: what you enter about it (its names, address, location on the map, time zone, phone, email, website, social links, imam, opening hours, capacity, facilities, donation link and logo), its prayer settings, its screens, and its content (announcements, activities, lectures, slideshow images and Islamic content).
- Your team: the email addresses of the admins you invite, and their roles and permissions.
- Accepting our terms: when you accepted the Terms of Service, which version (with a fingerprint of its exact text) and in which language, which version of this policy you were shown, and for which masjid.
- The activity log: which admin made which change, and when. It doesn’t record IP addresses or devices.
- Support: the messages and screenshots you send through Support in the portal.
- Billing: see Payments.
- Email preferences: which optional emails you’ve turned off.
- On your device only: in a web browser, your signed-in session and your “Keep me signed in” choice; in the iPhone and Android apps, whether you’ve turned on Face ID or fingerprint unlock. Your face or fingerprint never leaves your device: the app only asks your phone to confirm it’s you.
Your masjid’s details are public
What you enter about your masjid, including its contact details, imam, address and logo, is shown in the congregation app and on the website, and anyone can read it. Only enter what you’re happy to publish.
Worshippers
- No account, name or email address. The congregation app creates a random ID for your phone the first time it opens. It isn’t linked to you or to your phone’s hardware.
- The masjids you follow: we store which masjids that random ID follows, so a masjid can see how many followers it has. If the app isn’t opened for 90 days, these records are deleted automatically.
- Notifications: if you turn them on, your phone subscribes to topics for your masjid in Google’s Firebase Cloud Messaging (for example, “this masjid’s announcements, in Arabic”). We don’t keep a notification token for your phone.
- Location: only when you use “Near me”. Your phone’s location is sent to our server to find masjids nearby. It’s used for that search and isn’t stored.
- On your phone only: your followed masjids, language, prayer-alert settings and display choices stay in the app on your phone.
- Support: if you contact support from the app, we receive your email address, your message, any screenshots you attach, and the app version, your phone’s system and version, the app’s language and your main masjid, so that we can help. It reaches us by email and isn’t stored in our database.
TV screens
When a TV is connected to a masjid, the TV app creates a random ID for that screen and sends it with the app version, the screen’s language and orientation, and then a regular “still online” signal. Nothing is collected about the people who see the screen.
Website visitors
- The website sets no cookies and uses no analytics or tracking. It remembers two choices in your own browser: light or dark mode, and whether you closed the language suggestion.
- The contact form: your name, email address, masjid and city, country, phone or WhatsApp number if you give one, the topic and your message. It reaches us by email and isn’t stored in our database.
- A masjid’s page (masjidnexus.com/m/…): to show the masjid’s name, your browser asks our database for its public details.
Protection against spam
To stop the contact forms being misused, we keep a code made from the sender’s network (IP) address with a secret key that changes every day, with the time, for about a day. The code can’t be turned back into the address.
How we use it
- To provide MasjidNexus: run the portal, show a masjid’s times on its screens and in the app, and send the emails the service needs (sign-in codes, security notices, billing, deletion and support).
- To keep accounts secure: two-step sign-in, checking new passwords against known data breaches, and preventing abuse.
- To answer your questions and support requests.
- To send optional emails (tips, monthly summaries and notices of iqama changes). You can turn them off at any time, with the link in each email or in the portal.
- To meet legal, tax and accounting obligations.
Legal bases
Where data-protection laws apply, such as Oman’s Personal Data Protection Law, the EU GDPR or the UK GDPR, we rely on:
- contract, to provide the service to masjids and their admins;
- legitimate interests, to keep the service secure, prevent abuse and improve it, in ways you would reasonably expect;
- consent, for notifications and location in the congregation app, which you can withdraw in the app or in your phone’s settings;
- legal obligation, to keep payment and tax records.
Payments
Payments are handled by Paddle.com, our Merchant of Record. Paddle collects your card or other payment details, your billing details and tax information under its own privacy policy. We never see or store card details. We receive and keep your subscription’s status and renewal date, the amount, tax, currency and invoice number of each payment, and Paddle’s references for your subscription and customer record.
Who we share it with
We use these providers to run MasjidNexus. They process data on our behalf, only to provide their service.
| Provider | For | What it receives |
|---|---|---|
| Supabase | database, sign-in, file storage and server functions (servers in Singapore) | everything the service stores |
| Paddle | payments, invoices, tax and refunds | the admin’s email address and billing details |
| Resend | sending email | email addresses and the content of the emails, including contact and support messages |
| Google (Firebase Cloud Messaging) | notifications in the congregation app | the topics a phone subscribes to |
| Google and Apple | sign-in, if you choose them | as set by them |
| Cloudflare | hosting the website | your requests to the website, as any web host |
| OpenStreetMap (Nominatim), Geoapify, and Google Maps if enabled | maps and address search in the portal | the search text, the map location, and your IP address when map images load |
| Al Quran Cloud | Quran verses and translations in the portal | which verse is requested |
| Have I Been Pwned | checking a new password against known breaches | a short fragment of the password’s hash, never the password |
We may also share data when the law requires it, or to protect the rights and safety of our users or ourselves.
International transfers
Our providers process data in several countries, including Singapore (our database), the United States and the United Kingdom. Where the law requires it, we rely on the safeguards these providers offer for international transfers.
How long we keep it
- Accounts and masjids: for as long as they exist. If a masjid doesn’t subscribe after its free trial, its data is kept for 90 days after the trial ends; after a paid subscription ends, for 12 months. In that time it can subscribe and carry on; after it, we may delete the masjid and its data, emailing its admins at least 30 days before. You can delete it at any time; see Account deletion.
- Your acceptance of our terms: kept while your account exists, and for 6 years after it’s deleted, as a record of what was agreed.
- After a deletion request: you have 30 days to change your mind; then we permanently delete the masjid or account, and cancel a deleted masjid’s subscription. We keep payment, invoice and tax records (as the law requires), support conversations, a log of the emails we sent, and a record that the deletion took place.
- Logins without a masjid: deleted after 90 days without one (we email a week before), or straight away if you delete it yourself. A login made for an invitation that’s withdrawn before it was ever used is deleted with the invitation.
- The congregation app’s follow records: deleted when you unfollow or clear the app’s data, or after 90 days without the app being opened.
- Spam-protection hashes: about a day.
Security
All connections are encrypted. Each masjid’s data can be reached only by its own admins, which the database itself enforces. Every password sign-in needs a second step (a code by email, or an authenticator app), new passwords are checked against known breaches, and our service keys stay on our servers. No system is perfectly secure, but we work to protect your data, and we’ll tell you if a breach affects you, as the law requires.
Your rights
Depending on where you live, you can ask to see, correct, export or delete your personal data, to object to or limit how we use it, and to withdraw your consent. Admins can correct most details, and delete their account or masjid, themselves in the portal. For anything else, email support@masjidnexus.com and we’ll answer within 30 days. If you’re not satisfied, you can complain to your data-protection authority.
Children
The admin portal is for adults acting for a masjid. The congregation app can be used by anyone; it has no accounts and doesn’t ask for anyone’s name, email address or age.
Changes to this policy
If we change this policy, we’ll update the date at the top, and tell admins by email or in the portal when the change is significant.
Contact
Moosa Salim, trading as SmartHorizon, Oman. Email: support@masjidnexus.com